[c-nsp] Netflow Version 9

[Paolo Lucente]

v8 was only a static way to introduce aggregation in NetFlow.
v9, aggregation caches, FNF rather quickly obsoleted such idea
of fixed aggregation schemes and brought more felxibility. v5
is per-se able to carry up to full micro-flow information (up
to because nothing prevents to aggregate by removing info from
the record; not clean but still possible ..), plain and simple.
Plus have the feeling v5 is still the most deployed version of
NetFlow around.

Cheers,
Paolo


On Sun, Jan 16, 2011 at 12:59:16PM +0200, Ziv Leyes wrote:
> It was just a curiosity I was asking about.
> If the progress over the years made older versions obsolete it's understandable, but then, I don't see why is 5 still there and then 9, why not 1,5,6 , then years later perhaps 5,6,7, and so on, and at the end, 8,9, for instance...
> I mean, if 8 is obsolete, wouldn't 5 be "more" obsolete and die before?
> Maybe I didn't get properly the differences between the versions, I need to get back to read more deeply...
> 
> 
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of ?ukasz Bromirski
> Sent: Sunday, January 16, 2011 12:39 PM
> To: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Netflow Version 9
> 
> On 2011-01-16 11:00, Ziv Leyes wrote:
> > I knew this is likely to be the answer I get, I was wondering why
>  > in a Cisco device you can opt for ip flow-export version 1, 5 or 9,  > not all the other in between...
> 
> Wouldn't it be obvious? Some are long obsoleted and some made to work around limitations of specific architecture. The v9 was then made to get the best from flexibility. It doesn't make much more sense to keep the obsoleted templates in software and hardware just for someone to be able to get back in time a bit :)
> 
> -- 
> "Everything will be okay in the end.  |                 ?ukasz Bromirski
>   If it's not okay, it's not the end." |      http://lukasz.bromirski.net
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 
>  
>  
> ************************************************************************************
> This footnote confirms that this email message has been scanned by PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
> ************************************************************************************
> 
> 
> 
> 
> The information contained in this e-mail message and its attachments is confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the sender, and then delete the message from your computer.  Thank you!
> 
> ******** This mail was sent via Mail-SeCure System.********
> 
> 
> 
>  
>  
> ************************************************************************************
> This footnote confirms that this email message has been scanned by
> PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
> ************************************************************************************
> 
> 
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/